421 lines
16 KiB
JavaScript
421 lines
16 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs/promises';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { spawn } from 'node:child_process';
|
|
import test from 'node:test';
|
|
import { startLocalWriteAuthProxy } from './test-support/local-write-auth-proxy.js';
|
|
|
|
const root = path.resolve(import.meta.dirname, '..');
|
|
const LOCAL_API_URL = 'http://127.0.0.1:47145';
|
|
const BACKEND_API_URL = 'http://127.0.0.1:47146';
|
|
const TEST_API_USER = 'local-write-user';
|
|
const TEST_API_PASSWORD = 'local-write-password';
|
|
const WRITE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
|
|
const PNG_FILE = Buffer.from(
|
|
'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9Y9ZQmcAAAAASUVORK5CYII=',
|
|
'base64'
|
|
);
|
|
const MP3_FILE = Buffer.concat([
|
|
Buffer.from('49443304000000000000', 'hex'),
|
|
Buffer.from('fffb9064', 'hex'),
|
|
Buffer.alloc(512)
|
|
]);
|
|
const WAV_FILE = Buffer.from(
|
|
'524946462400000057415645666d74201000000001000100401f0000803e0000020010006461746100000000',
|
|
'hex'
|
|
);
|
|
|
|
async function runProcess(command, args, options = {}) {
|
|
const child = spawn(command, args, {
|
|
...options,
|
|
stdio: ['ignore', 'pipe', 'pipe']
|
|
});
|
|
const stdout = [];
|
|
const stderr = [];
|
|
child.stdout.on('data', chunk => stdout.push(chunk.toString()));
|
|
child.stderr.on('data', chunk => stderr.push(chunk.toString()));
|
|
const status = await new Promise((resolve, reject) => {
|
|
child.once('error', reject);
|
|
child.once('exit', resolve);
|
|
});
|
|
return { status, stdout: stdout.join(''), stderr: stderr.join('') };
|
|
}
|
|
|
|
function authorizationHeader() {
|
|
const token = Buffer.from(`${TEST_API_USER}:${TEST_API_PASSWORD}`, 'utf8').toString('base64');
|
|
return `Basic ${token}`;
|
|
}
|
|
|
|
async function fetchWithWriteAuthRetry(url, options = {}) {
|
|
const request = new Request(url, options);
|
|
const response = await fetch(request.clone());
|
|
if (!WRITE_METHODS.has(request.method) || response.status !== 401) return response;
|
|
|
|
assert.match(response.headers.get('www-authenticate') || '', /^Basic\s/i);
|
|
await response.arrayBuffer();
|
|
|
|
const headers = new Headers(request.headers);
|
|
headers.set('Authorization', authorizationHeader());
|
|
return fetch(new Request(request, { headers }));
|
|
}
|
|
|
|
async function requestJson(url, options = {}, expectedStatus = 200) {
|
|
const response = await fetchWithWriteAuthRetry(url, options);
|
|
const body = await response.json();
|
|
assert.equal(response.status, expectedStatus, JSON.stringify(body));
|
|
return { response, body };
|
|
}
|
|
|
|
async function requestBuffer(url, expectedStatus = 200) {
|
|
const response = await fetch(url);
|
|
const body = Buffer.from(await response.arrayBuffer());
|
|
assert.equal(response.status, expectedStatus);
|
|
return { response, body };
|
|
}
|
|
|
|
async function waitForServer(baseUrl, child, output) {
|
|
for (let attempt = 0; attempt < 80; attempt += 1) {
|
|
if (child.exitCode != null) throw new Error(`Server wurde vorzeitig beendet.\n${output.join('')}`);
|
|
try {
|
|
const response = await fetch(`${baseUrl}/api/health`);
|
|
if (response.ok) return;
|
|
} catch {
|
|
// Server startet noch.
|
|
}
|
|
await new Promise(resolve => setTimeout(resolve, 100));
|
|
}
|
|
throw new Error(`Serverstart hat das Zeitlimit überschritten.\n${output.join('')}`);
|
|
}
|
|
|
|
test('the npm-started local API is exercised through a write-auth proxy on loopback port 47145', { timeout: 30000 }, async t => {
|
|
const runtime = await fs.mkdtemp(path.join(os.tmpdir(), 'wegwichtel-media-api-'));
|
|
const baseUrl = LOCAL_API_URL;
|
|
let authProxy;
|
|
const output = [];
|
|
const npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm';
|
|
const detached = process.platform !== 'win32';
|
|
const child = spawn(npmCommand, ['start'], {
|
|
cwd: root,
|
|
env: {
|
|
...process.env,
|
|
HOST: '127.0.0.1',
|
|
PORT: '47146',
|
|
DATA_DIR: path.join(runtime, 'data'),
|
|
STORAGE_DIR: path.join(runtime, 'storage')
|
|
},
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
detached
|
|
});
|
|
child.stdout.on('data', chunk => output.push(chunk.toString()));
|
|
child.stderr.on('data', chunk => output.push(chunk.toString()));
|
|
|
|
t.after(async () => {
|
|
if (authProxy) await authProxy.close();
|
|
if (child.exitCode == null) {
|
|
if (detached) {
|
|
try {
|
|
process.kill(-child.pid, 'SIGTERM');
|
|
} catch (error) {
|
|
if (error.code !== 'ESRCH') throw error;
|
|
}
|
|
} else {
|
|
child.kill('SIGTERM');
|
|
}
|
|
await new Promise(resolve => child.once('exit', resolve));
|
|
}
|
|
await fs.rm(runtime, { recursive: true, force: true });
|
|
});
|
|
|
|
await waitForServer(BACKEND_API_URL, child, output);
|
|
authProxy = await startLocalWriteAuthProxy({
|
|
listenPort: 47145,
|
|
targetPort: 47146,
|
|
username: TEST_API_USER,
|
|
password: TEST_API_PASSWORD
|
|
});
|
|
|
|
const healthResponse = await fetch(`${baseUrl}/api/health`);
|
|
assert.equal(healthResponse.status, 200);
|
|
assert.equal(healthResponse.headers.get('www-authenticate'), null);
|
|
|
|
const pythonHealthCheck = await runProcess('python3', ['-c', `
|
|
from common import ApiClient
|
|
result = ApiClient('${LOCAL_API_URL}').request('GET', '/api/health')
|
|
assert result['ok'] is True
|
|
`], {
|
|
cwd: root,
|
|
env: {
|
|
...process.env,
|
|
API_USER: '',
|
|
API_PASSWORD: '',
|
|
PYTHONPATH: path.join(root, 'tools/python')
|
|
}
|
|
});
|
|
assert.equal(
|
|
pythonHealthCheck.status,
|
|
0,
|
|
[pythonHealthCheck.stdout, pythonHealthCheck.stderr].filter(Boolean).join('\n')
|
|
);
|
|
|
|
const gpxPath = path.join(root, 'examples', 'sample-route.gpx');
|
|
const gpx = await fs.readFile(gpxPath);
|
|
const createRoute = await runProcess('python3', [
|
|
path.join(root, 'tools/python/create_route.py'),
|
|
'--base-url', LOCAL_API_URL,
|
|
'--name', 'Medien-API-Test',
|
|
'--slug', '',
|
|
'--description', '',
|
|
'--school-name', '',
|
|
'--gpx', gpxPath
|
|
], {
|
|
cwd: root,
|
|
env: {
|
|
...process.env,
|
|
API_USER: ` ${TEST_API_USER} `,
|
|
API_PASSWORD: ` ${TEST_API_PASSWORD} `,
|
|
PYTHONPATH: path.join(root, 'tools/python')
|
|
}
|
|
});
|
|
assert.equal(
|
|
createRoute.status,
|
|
0,
|
|
[createRoute.stdout, createRoute.stderr].filter(Boolean).join('\n')
|
|
);
|
|
const route = JSON.parse(createRoute.stdout);
|
|
assert.equal(route.gpxUrl, `/api/routes/${route.id}/gpx`);
|
|
const { response: gpxResponse, body: downloadedGpx } = await requestBuffer(`${baseUrl}${route.gpxUrl}`);
|
|
assert.match(gpxResponse.headers.get('content-type') || '', /application\/gpx\+xml/);
|
|
assert.deepEqual(downloadedGpx, gpx);
|
|
|
|
const { body: poi } = await requestJson(`${baseUrl}/api/routes/${route.id}/pois`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
title: 'Teststation',
|
|
description: 'Station für Medientests',
|
|
lat: route.start.lat,
|
|
lon: route.start.lon,
|
|
triggerRadiusM: 40,
|
|
sequence: 0
|
|
})
|
|
}, 201);
|
|
|
|
const { body: otherPoi } = await requestJson(`${baseUrl}/api/routes/${route.id}/pois`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
title: 'Andere Teststation',
|
|
lat: route.start.lat + 0.0001,
|
|
lon: route.start.lon + 0.0001,
|
|
triggerRadiusM: 40,
|
|
sequence: 1
|
|
})
|
|
}, 201);
|
|
|
|
const { body: fetchedPoi } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}`
|
|
);
|
|
assert.equal(fetchedPoi.id, poi.id);
|
|
assert.equal(fetchedPoi.routeId, route.id);
|
|
assert.equal(fetchedPoi.title, 'Teststation');
|
|
|
|
const { body: updatedPoi } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}`,
|
|
{
|
|
method: 'PUT',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ title: 'Aktualisierte Teststation' })
|
|
}
|
|
);
|
|
assert.equal(updatedPoi.title, 'Aktualisierte Teststation');
|
|
|
|
await requestJson(`${baseUrl}/api/routes/999999/pois/${poi.id}`, {}, 404);
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/999999`, {}, 404);
|
|
await requestJson(`${baseUrl}/api/pois/${poi.id}`, {}, 404);
|
|
|
|
const pictureForm = new FormData();
|
|
pictureForm.append('poiId', String(otherPoi.id));
|
|
pictureForm.append('caption', 'Erste Bildbeschreibung');
|
|
pictureForm.append('sequence', '0');
|
|
pictureForm.append('picture', new Blob([PNG_FILE], { type: 'application/octet-stream' }), 'bild.txt');
|
|
const { response: pictureResponse, body: picture } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/pictures`,
|
|
{ method: 'POST', body: pictureForm },
|
|
201
|
|
);
|
|
assert.equal(pictureResponse.headers.get('location'), `/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`);
|
|
assert.equal(picture.poiId, poi.id);
|
|
assert.equal(picture.caption, 'Erste Bildbeschreibung');
|
|
assert.equal(picture.url, `/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`);
|
|
const { response: pictureFileResponse, body: pictureFile } = await requestBuffer(`${baseUrl}${picture.url}`);
|
|
assert.match(pictureFileResponse.headers.get('content-type') || '', /image\/png/);
|
|
assert.deepEqual(pictureFile, PNG_FILE);
|
|
const { body: pictureMetadata } = await requestJson(`${baseUrl}${picture.url}?metadata=true`);
|
|
assert.equal(pictureMetadata.caption, 'Erste Bildbeschreibung');
|
|
assert.equal(pictureMetadata.poiId, poi.id);
|
|
await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/pictures/${picture.id}?metadata=true`,
|
|
{},
|
|
404
|
|
);
|
|
|
|
const { body: pictureList } = await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/pictures`);
|
|
assert.equal(pictureList.pictures.length, 1);
|
|
assert.equal(pictureList.pictures[0].id, picture.id);
|
|
|
|
const jsonPicturePayload = {
|
|
caption: 'Bild aus JSON',
|
|
sequence: 1,
|
|
picture: {
|
|
filename: 'bild-json.bin',
|
|
base64: PNG_FILE.toString('base64')
|
|
}
|
|
};
|
|
const { body: jsonPicture } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/pictures`,
|
|
{
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'text/json' },
|
|
body: JSON.stringify(jsonPicturePayload)
|
|
},
|
|
201
|
|
);
|
|
assert.equal(jsonPicture.poiId, otherPoi.id);
|
|
assert.equal(jsonPicture.caption, 'Bild aus JSON');
|
|
const { response: jsonPictureResponse, body: jsonPictureFile } = await requestBuffer(`${baseUrl}${jsonPicture.url}`);
|
|
assert.match(jsonPictureResponse.headers.get('content-type') || '', /image\/png/);
|
|
assert.deepEqual(jsonPictureFile, PNG_FILE);
|
|
|
|
await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/pictures`,
|
|
{
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'text/json' },
|
|
body: '{}'
|
|
},
|
|
400
|
|
);
|
|
|
|
await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/pictures`,
|
|
{
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
picture: {
|
|
filename: 'behauptetes-bild.png',
|
|
contentType: 'image/png',
|
|
base64: Buffer.from('kein Bild').toString('base64')
|
|
}
|
|
})
|
|
},
|
|
415
|
|
);
|
|
|
|
const { body: updatedPicture } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`,
|
|
{
|
|
method: 'PUT',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ caption: 'Aktualisierte Bildbeschreibung', sequence: 2 })
|
|
}
|
|
);
|
|
assert.equal(updatedPicture.caption, 'Aktualisierte Bildbeschreibung');
|
|
assert.equal(updatedPicture.sequence, 2);
|
|
|
|
const audioForm = new FormData();
|
|
audioForm.append('audio', new Blob([MP3_FILE], { type: 'application/octet-stream' }), 'ansage.txt');
|
|
const { response: audioResponse, body: audio } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/audio`,
|
|
{ method: 'POST', body: audioForm },
|
|
201
|
|
);
|
|
assert.equal(audioResponse.headers.get('location'), `/api/routes/${route.id}/pois/${poi.id}/audio`);
|
|
assert.equal(audio.poiId, poi.id);
|
|
assert.equal(audio.url, `/api/routes/${route.id}/pois/${poi.id}/audio`);
|
|
const { response: audioFileResponse, body: audioFile } = await requestBuffer(`${baseUrl}${audio.url}`);
|
|
assert.match(audioFileResponse.headers.get('content-type') || '', /audio\/mpeg/);
|
|
assert.deepEqual(audioFile, MP3_FILE);
|
|
const { body: audioMetadata } = await requestJson(`${baseUrl}${audio.url}?metadata=true`);
|
|
assert.equal(audioMetadata.poiId, poi.id);
|
|
|
|
const duplicateAudio = new FormData();
|
|
duplicateAudio.append('audio', new Blob([MP3_FILE], { type: 'image/png' }), 'doppelt.png');
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/audio`, {
|
|
method: 'POST',
|
|
body: duplicateAudio
|
|
}, 409);
|
|
|
|
const replacementAudio = {
|
|
audio: {
|
|
filename: 'ansage-neu.bin',
|
|
base64: WAV_FILE.toString('base64')
|
|
}
|
|
};
|
|
const { body: replacedAudio } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/audio`,
|
|
{
|
|
method: 'PUT',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(replacementAudio)
|
|
}
|
|
);
|
|
assert.equal(replacedAudio.url, `/api/routes/${route.id}/pois/${poi.id}/audio`);
|
|
const { response: replacedAudioResponse, body: replacedAudioFile } = await requestBuffer(`${baseUrl}${replacedAudio.url}`);
|
|
assert.match(replacedAudioResponse.headers.get('content-type') || '', /audio\/wav/);
|
|
assert.deepEqual(replacedAudioFile, WAV_FILE);
|
|
|
|
const { body: routeWithMedia } = await requestJson(`${baseUrl}/api/routes/${route.id}`);
|
|
assert.equal(routeWithMedia.pois[0].images[0].caption, 'Aktualisierte Bildbeschreibung');
|
|
assert.equal(routeWithMedia.gpxUrl, `/api/routes/${route.id}/gpx`);
|
|
assert.equal(routeWithMedia.pois[0].audioUrl, `/api/routes/${route.id}/pois/${poi.id}/audio`);
|
|
assert.equal(routeWithMedia.pois[0].images[0].url, `/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`);
|
|
assert.doesNotMatch(JSON.stringify(routeWithMedia), /\/media\//);
|
|
const legacyMediaResponse = await fetch(`${baseUrl}/media/routes/${route.id}/route.gpx`);
|
|
assert.equal(legacyMediaResponse.status, 404);
|
|
const legacyPictureEndpoint = await fetch(`${baseUrl}/api/routes/${route.id}/pictures`);
|
|
assert.equal(legacyPictureEndpoint.status, 404);
|
|
const legacyAudioEndpoint = await fetch(`${baseUrl}/api/routes/${route.id}/audio`);
|
|
assert.equal(legacyAudioEndpoint.status, 404);
|
|
|
|
const { body: deletedAudio } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/audio`,
|
|
{ method: 'DELETE' }
|
|
);
|
|
assert.equal(deletedAudio.deleted, true);
|
|
|
|
const { body: deletedPicture } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`,
|
|
{ method: 'DELETE' }
|
|
);
|
|
assert.equal(deletedPicture.deleted, true);
|
|
|
|
const otherAudioForm = new FormData();
|
|
otherAudioForm.append('audio', new Blob([MP3_FILE], { type: 'text/plain' }), 'falsch.txt');
|
|
await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/audio`,
|
|
{ method: 'POST', body: otherAudioForm },
|
|
201
|
|
);
|
|
|
|
const { body: deletedPoi } = await requestJson(
|
|
`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}`,
|
|
{ method: 'DELETE' }
|
|
);
|
|
assert.equal(deletedPoi.deleted, true);
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}`, {}, 404);
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/pictures/${jsonPicture.id}`, {}, 404);
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${otherPoi.id}/audio`, {}, 404);
|
|
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/pictures/${picture.id}`, {}, 404);
|
|
await requestJson(`${baseUrl}/api/routes/${route.id}/pois/${poi.id}/audio`, {}, 404);
|
|
|
|
for (const method of ['POST', 'PUT', 'DELETE']) {
|
|
assert.ok(authProxy.stats.unauthorizedWrites[method] > 0, `${method} muss zunächst HTTP 401 auslösen.`);
|
|
assert.ok(authProxy.stats.authorizedWrites[method] > 0, `${method} muss mit Basic Auth weitergeleitet werden.`);
|
|
}
|
|
assert.ok(authProxy.stats.forwardedReads > 0);
|
|
assert.equal(authProxy.stats.authenticatedReads, 0, 'Lesende Requests dürfen nicht präventiv authentifiziert werden.');
|
|
});
|